CVE-2026-54369
acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
| CWE | CWE-59 |
| Vendor | acl project |
| Product | acl |
| Published | Jun 29, 2026 |
| Last Updated | Jun 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for acl project acl
Be the first to know when new high vulnerabilities affecting acl project acl are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
acl project / acl
0 < 2.4.0
References
cgit.git.savannah.nongnu.org: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1 cgit.git.savannah.nongnu.org: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5 vulncheck.com: https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions
Credits
Andrew Tridgell Andreas Gruenbacher